Executive brief
A vulnerability was identified in the Linux kernel's Intel IOMMU (VT-d) driver, which manages how hardware devices interact with system memory. Under specific conditions during device disconnection, the system could experience a crash or memory corruption. This could lead to system instability, a denial-of-service state, or potentially allow unauthorized access to memory used by other active devices.
Technical details
A flaw exists in the 'domain_remove_dev_pasid' function within 'drivers/iommu/intel/iommu.c' of the Linux kernel. When a PASID (Process Address Space ID) is not found in the device list, the code fails to exit early, proceeding to execute teardown operations on a NULL pointer or incorrectly decrementing a reference counter. This can result in an immediate kernel panic (NULL pointer dereference) or a use-after-free condition due to premature dropping of the domain reference count. The issue is triggered during IOMMU domain detachment and has been resolved by implementing an early return check if the 'dev_pasid' structure is NULL.
Affected products
- Linux Linux Kernel 6.12.57, 6.13.3, 6.14, 6.18.33, 7.0.10
Timeline
- 2026-05-11: patched: Initial fix committed to mainline kernel tree.
- 2026-06-26: disclosed: CVE-2026-53281 published.